According to this answer, DLL injection through
CreateRemoteThread in conjunction with
LoadLibraryA can be prevented by hooking
LoadLibraryA. I went through the effort of doing an actual implementation of both the attacking side and defending side. I used this article as a baseline for creating both applications.
The defending side succesfully hooks
LoadLibraryA and replaces it with a dummy function. The dummy function gets called whenever the defending process calls
But why is it that the attacking process is still able to call the original
LoadLibraryA after creating a remote thread in the defending process?
It's almost as if it does not access it through the IAT. Wouldn't it otherwise get forwarded to the dummy function?